System memory in an operating system (OS) is divided into two distinct regions: kernel space and user space. Kernel space hosts the kernel or core of the OS. The kernel manages the system's resources (for example, memory, processors, I/O devices, and other resources) and communication between hardware and software components. User space is the region in which user processes/applications (i.e., not the kernel) run. The kernel space can be accessed by the user processes through the use of system calls in order to gain access to the services provided by the kernel.
In some instances, kernel modules (for example, device drivers, network drivers, file systems, and other kernel modules) are dynamically loaded into the kernel space whenever a demand for a new component arises. When a kernel module is loaded into the kernel space, a sufficient amount of kernel memory is allocated to it via a request such as, for example, user space requests through system calls, hardware requests while handling interrupts, or other requests. When a kernel module is unloaded from the kernel space, the allocated kernel memory should be de-allocated from the unloaded module and, as such, should be usable for other purposes.
Typically, the kernel resolves references to kernel memory allocation and de-allocation function addresses from the loaded kernel module to carry out memory allocation and de allocation. In some instances, the kernel utilizes a kernel global symbol table to resolve these references, wherein the kernel global symbol table maintains a list of all the kernel's resources, functions and data types provided by the kernel, functions and data types provided by loaded modules, as well as, system calls.
Generally, a memory leak is caused by an application or by a process that allocates memory for use, but does not free the memory up when it is no longer needed. This may cause the operating system (OS) to hang or otherwise function improperly until the allocated memory is released, or may cause other problems. Accordingly, kernel memory leaks occur when kernel memory is allocated to a kernel module but not de-allocated when the module is unloaded.
Hence, there exists a need for a tracking system that tracks information regarding the kernel memory allocations/de-allocations to determine the existence and/or cause of a kernel memory leak.